o Mf> @s:dZddlmZddlZddlZddlZzddlZWn ey%dZYnwz ddlZddl ZWneyAZ zede dZ [ wwddl m Z ddl mZddl mZddl mZdd lmZe eje d krpejjZnejjZeeZGd d d ejZGd ddejZddZddZGdddeZ dS)zTransport adapter for urllib3.)absolute_importNzjThe urllib3 library is not installed from please install the urllib3 package to use the urllib3 transport.)version)environment_vars) exceptions) transport)service_accountz2.0.0c@s<eZdZdZddZeddZeddZedd Zd S) _Responsezurllib3 transport response adapter. Args: response (urllib3.response.HTTPResponse): The raw urllib3 response. cC ||_dSN) _response)selfresponser_/var/www/html/analyze/labelStudio/lib/python3.10/site-packages/google/auth/transport/urllib3.py__init__A z_Response.__init__cC|jjSr )r statusr rrrrDz_Response.statuscCrr )r headersrrrrrHrz_Response.headerscCrr )r datarrrrrLrz_Response.dataN) __name__ __module__ __qualname____doc__rpropertyrrrrrrrr:s  rc@s$eZdZdZddZ dddZdS) Requesta#urllib3 request adapter. This class is used internally for making requests using various transports in a consistent way. If you use :class:`AuthorizedHttp` you do not need to construct or use this class directly. This class can be useful if you want to manually refresh a :class:`~google.auth.credentials.Credentials` instance:: import google.auth.transport.urllib3 import urllib3 http = urllib3.PoolManager() request = google.auth.transport.urllib3.Request(http) credentials.refresh(request) Args: http (urllib3.request.RequestMethods): An instance of any urllib3 class that implements :class:`~urllib3.request.RequestMethods`, usually :class:`urllib3.PoolManager`. .. automethod:: __call__ cCr r )http)r rrrrrkrzRequest.__init__GETNc Ksr|dur||d<ztd|||jj||f||d|}t|WStjjy8}zt|} | |d}~ww)a=Make an HTTP request using urllib3. Args: url (str): The URI to be requested. method (str): The HTTP method to use for the request. Defaults to 'GET'. body (bytes): The payload / body in HTTP request. headers (Mapping[str, str]): Request headers. timeout (Optional[int]): The number of seconds to wait for a response from the server. If not specified or if None, the urllib3 default timeout will be used. kwargs: Additional arguments passed throught to the underlying urllib3 :meth:`urlopen` method. Returns: google.auth.transport.Response: The HTTP response. Raises: google.auth.exceptions.TransportError: If any exception occurred. NtimeoutzMaking request: %s %sbodyr) _LOGGERdebugrrequestrurllib3r HTTPErrorTransportError) r urlmethodr"rr kwargsr caught_excnew_excrrr__call__ns"  zRequest.__call__)rNNN)rrrrrr.rrrrrQs rcCs"tdur tjdtdStS)N CERT_REQUIRED) cert_reqsca_certs)certifir& PoolManagerwhererrrr_make_default_httpsr5c Csddl}ddlm}ddl}|jj|jj }|j | d| |j |}||j |}|j||j||j|d}|S)aCreate a mutual TLS HTTP connection with the given client cert and key. See https://github.com/urllib3/urllib3/issues/474#issuecomment-253168415 Args: cert (bytes): client certificate in PEM format key (bytes): client private key in PEM format Returns: urllib3.PoolManager: Mutual TLS HTTP connection. Raises: ImportError: If certifi or pyOpenSSL is not installed. OpenSSL.crypto.Error: If the cert or key is invalid. rN)crypto)cafile) ssl_context)r2OpenSSLr6urllib3.contrib.pyopensslcontrib pyopensslinject_into_urllib3utilssl_create_urllib3_contextload_verify_locationsr4load_privatekey FILETYPE_PEMload_certificate_ctxuse_certificateuse_privatekeyr3) certkeyr2r6r&ctxpkeyx509rrrr_make_mutual_tls_https      rMcsteZdZdZdejejdffdd ZdddZdddZ d d Z d d Z d dZ e ddZejddZZS)AuthorizedHttpa A urllib3 HTTP class with credentials. This class is used to perform requests to API endpoints that require authorization:: from google.auth.transport.urllib3 import AuthorizedHttp authed_http = AuthorizedHttp(credentials) response = authed_http.request( 'GET', 'https://www.googleapis.com/storage/v1/b') This class implements :class:`urllib3.request.RequestMethods` and can be used just like any other :class:`urllib3.PoolManager`. The underlying :meth:`urlopen` implementation handles adding the credentials' headers to the request and refreshing credentials as needed. This class also supports mutual TLS via :meth:`configure_mtls_channel` method. In order to use this method, the `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable must be explicitly set to `true`, otherwise it does nothing. Assume the environment is set to `true`, the method behaves in the following manner: If client_cert_callback is provided, client certificate and private key are loaded using the callback; if client_cert_callback is None, application default SSL credentials will be used. Exceptions are raised if there are problems with the certificate, private key, or the loading process, so it should be called within a try/except block. First we set the environment variable to `true`, then create an :class:`AuthorizedHttp` instance and specify the endpoints:: regular_endpoint = 'https://pubsub.googleapis.com/v1/projects/{my_project_id}/topics' mtls_endpoint = 'https://pubsub.mtls.googleapis.com/v1/projects/{my_project_id}/topics' authed_http = AuthorizedHttp(credentials) Now we can pass a callback to :meth:`configure_mtls_channel`:: def my_cert_callback(): # some code to load client cert bytes and private key bytes, both in # PEM format. some_code_to_load_client_cert_and_key() if loaded: return cert, key raise MyClientCertFailureException() # Always call configure_mtls_channel within a try/except block. try: is_mtls = authed_http.configure_mtls_channel(my_cert_callback) except: # handle exceptions. if is_mtls: response = authed_http.request('GET', mtls_endpoint) else: response = authed_http.request('GET', regular_endpoint) You can alternatively use application default SSL credentials like this:: try: is_mtls = authed_http.configure_mtls_channel() except: # handle exceptions. Args: credentials (google.auth.credentials.Credentials): The credentials to add to the request. http (urllib3.PoolManager): The underlying HTTP object to use to make requests. If not specified, a :class:`urllib3.PoolManager` instance will be constructed with sane defaults. refresh_status_codes (Sequence[int]): Which HTTP status codes indicate that credentials should be refreshed and the request should be retried. max_refresh_attempts (int): The maximum number of times to attempt to refresh the credentials and retry the request. default_host (Optional[str]): A host like "pubsub.googleapis.com". This is used when a self-signed JWT is created from service account credentials. Ncs|dur t|_d|_n||_d|_||_||_||_||_t|j|_t |jt j r:|j |jr7d |jndtt|dS)NFTz https://{}/)r5r_has_user_provided_http credentials_refresh_status_codes_max_refresh_attempts _default_hostr_request isinstancer Credentials_create_self_signed_jwtformatsuperrNr)r rPrrefresh_status_codesmax_refresh_attempts default_host __class__rrrs zAuthorizedHttp.__init__c Csttjd}|dkr dSzddl}Wnty'}zt|}||d}~wwztj |\}}}|r;t |||_ nt |_ Wntjt|jjfyZ}zt|}||d}~ww|jrgd|_tdt|S)aSConfigures mutual TLS channel using the given client_cert_callback or application default SSL credentials. The behavior is controlled by `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable. (1) If the environment variable value is `true`, the function returns True if the channel is mutual TLS and False otherwise. The `http` provided in the constructor will be overwritten. (2) If the environment variable is not set or `false`, the function does nothing and it always return False. Args: client_cert_callback (Optional[Callable[[], (bytes, bytes)]]): The optional callback returns the client certificate and private key bytes both in PEM format. If the callback is None, application default SSL credentials will be used. Returns: True if the channel is mutual TLS and False otherwise. Raises: google.auth.exceptions.MutualTLSChannelError: If mutual TLS channel creation failed for any reason. falsetrueFrNz1`http` provided in the constructor is overwritten)osgetenvr!GOOGLE_API_USE_CLIENT_CERTIFICATEr9 ImportErrorrMutualTLSChannelErrorr _mtls_helperget_client_cert_and_keyrMrr5ClientCertErrorr6ErrorrOwarningswarn UserWarning) r client_cert_callbackuse_client_certr9r,r-found_cert_keyrHrIrrrconfigure_mtls_channel0sF    z%AuthorizedHttp.configure_mtls_channelc Ks|dd}|dur |j}|}|j|j||||jj||f||d|}|j|j vrW||j krWt d|j|d|j |j |j|j||f|||dd|S|S)z$Implementation of urllib3's urlopen._credential_refresh_attemptrNr!z;Refreshing credentials due to a %s response. Attempt %s/%s.)r"rrq)poprcopyrPbefore_requestrTrurlopenrrQrRr#inforefresh) r r*r)r"rr+rqrequest_headersr rrrrvms@   zAuthorizedHttp.urlopencCs |jSProxy to ``self.http``.)r __enter__rrrrr|s zAuthorizedHttp.__enter__cCs|j|||Srz)r__exit__)r exc_typeexc_valexc_tbrrrr}szAuthorizedHttp.__exit__cCs*t|dr|jdur|jdSdSdS)Nr)hasattrrclearrrrr__del__szAuthorizedHttp.__del__cCrrzrrrrrrrszAuthorizedHttp.headerscCs ||j_dS)r{Nr)r valuerrrrs r )NN)rrrrrDEFAULT_REFRESH_STATUS_CODESDEFAULT_MAX_REFRESH_ATTEMPTSrrprvr|r}rrrsetter __classcell__rrr]rrNs U =; rN)!r __future__rloggingrarjr2rdr&urllib3.exceptionsr, packagingr google.authrrr google.oauth2rparse __version___request_methodsRequestMethodsr% getLoggerrr#Responserrr5rMrNrrrrsF           D!